Fetching any submodule in a subproject with submodules #1013
Description
When fetching a project that contains submodules or other nested VCS dependencies (e.g. Git submodules, SVN externals), Dfetch currently does not fetch those dependencies at the exact revision recorded by the parent project.
For example, consider:
https://github.com/Mbed-TLS/TF-PSA-Crypto
This project contains a Git submodule under framework. When this repository is fetched with Dfetch, the submodule directory is created but its contents are not fetched at the referenced commit/revision. As a result:
- nested dependencies are missing,
- the project cannot build correctly,
- and reproducibility is lost.
Expected behavior
Dfetch should automatically:
- Detect nested dependencies (submodules, externals) recursively.
- Fetch each dependency at the exact pinned revision specified by the parent repository (e.g., Git submodule SHA, SVN revision, tag, or branch).
- Flatten the dependency content into the output directory, removing any VCS metadata (no .git/, no .svn/).
- Record complete provenance information inside dfetch_data.yaml so the final checkout is audit‑ready and reproducible.